CVE-2021-31956-POC

" CVE-2021-31956" WIP PoC code for CVE-2021-31956 in preparation for OSEE. Will improve it further after my OSEE exams and free time. A lot of hardcoded offsets need to be changed if it is different on the target system but if it is anything similar to 2020 - 2021 builds then no change should be...

CVE-2019-0708-poc

CVE-2019-0708 Big shout out to the Dox King Krebs and also the thief of inventions and all-purpose fraud, Kevin. https://www.youtube.com/watch?v=dQw4w9WgXcQ...

clairvoyance

🔮 clairvoyance Clairvoyance /klɛərˈvɔɪəns /; from French clair meaning clear and voyance meaning vision from Wikipedia. Overview clairvoyance creates a colorful visualization of the page protection of an entire 64-bit process address space user and kernel running on a Windows 64-bit kernel. To...

CVE-2019-0803

CVE-2019-0803 Win32k Elevation of Privilege Poc Screenshot Reference steal Security token https://github.com/mwrlabs/CVE-2016-7255...

CVE_2026_40369

CVE202640369 Exploit poc and exp for CVE202640369, related to my analyze, use cmake. Debug code, poc and exp files for reproducing CVE202640369, written with cmake. As before, you can compile it directly using the regular cmake commands. About the analysis article: WeChat Official Account:...

CVE-2021-21551

CVE-2021-21551 Proof of concept exploit for CVE-2021-21551, vulnerability comes from user provided addresses being provided as arguments to a memmove call allowing for an arbitary read/write ioctls 0x9B0C1EC4 and 0x9B0C1EC8 as well as the physical address parameter for a MmMapIoSpace call that...

CVE-2021-31955-POC

CVE-2021-31955 Windows Kernel Information Disclosure POC The exploit works on all 64-bit vulnerable targets. unpatched system patched system...

nmap-CVE-2022-21907

nmap-CVE-2022-21907 Repository containing nse script for vulnerability CVE-2022-21907. It is a component IIS vulnerability on Windows. It allows remote code execution. The vulnerability affects the kernel module http.sys, which handles most basic IIS operations. After uploading the payload, the...

LPE---CVE-2020-0796

Usage: Make sure Python is installed, then run poc.py. Windows Kernel Write-What-Where CVE-2020-0796 Exploit Intended only for educational and testing in corporate environments. MasterSpl0it takes no responsibility for the code, use at your own risk. Rewritten CVE-2020-0796 Local Privilege...

CVE-2024-30088-Windows-poc

CVE-2024-30088-Windows-poc This vulnerability exists in the NtQueryInformationToken function, specifically when handling the AuthzBasepCopyoutInternalSecurityAttributes function. It originates from improper management of the locking mechanism by the kernel when operating on objects. This flaw cou...

cve-2025-62215-exploit-poc

CVE-2025-62215 Proof-of-Concept ⚠️ WARNING - LEGAL AND ETHICAL NOTICE THIS CODE IS FOR EDUCATIONAL AND SECURITY RESEARCH PURPOSES ONLY. DO NOT use this code on systems you do not own or have explicit written permission to test DO NOT use this code for malicious purposes Unauthorized access to...

herpaderping

Process Herpaderping png.HerpaderpIcon Process Herpaderping は、イメージがマッピングされた後にディスク上のコンテンツを変更することで、プロセスの意図を隠蔽する手法です。これにより、セキュリティ製品やOS自体に興味深い動作が発生します。 !png.mimioogle !gif.SurivDemo 概要...

dumpscan

本ツールの公開開発は一時停止していますが、プライベートでは引き続き開発中です。2024年第3四半期/第4四半期に大規模なアップデートを予定しています。 Dumpscan は、カーネルおよび Windows Minidump 形式からシークレットを抽出およびダンプするために設計されたコマンドラインツールです。カーネルダンプの解析は volatility3 によって提供されています。 機能 x509 公開鍵および秘密鍵 PKCS 8/PKCS 1 の解析 SymCrypt の解析 対応構造体 SYMCRYPTRSAKEY - 鍵構造体が秘密鍵も持つかどうかを判定...

CVE-2024-55511

CVE-2024-55511 This repository has been archived and moved here A null pointer dereference vulnerability in Macrium Reflect prior to 8.1.8017 allows a local attacker to cause a system crash or potentially elevate their privileges via executing a specially crafted executable. I am currently creati...

CVE-2020-1034

CVE-2020-1034 Warning This repository contains a working exploit. Publication was made for educational purposes only. Owner of this repository is not responsible for any damage done by any part of source code published here. This repository was created as a homework for "Protected Information...

Kernel-Arbitrary-Read-Vulnerability-Superfetch-EOP

Kernel-Arbitrary-Read-Vulnerability-Superfetch-EOP Kernel Arbitrary Read Vulnerability + Superfetch EOP based on reacher from https://starlabs.sg/blog/2022/06-trying-to-exploit-a-windows-kernel-arbitrary-read-vulnerability/ . Exploit must be run from low integrity...

criPPLe

criPPLe Windows 内核驱动程序，用于移除进程保护（PP）和进程保护轻量级（PPL）。 本工具借助 Zero-Point Security 的 "Offensive Driver Development 课程" 开发而成 该内核驱动程序可移除指定 pid 的进程保护，它获取进程 PSPROTECTION 结构体的指针，并将这些值设置为 0。 PSPROTECTION +0x000 Level : UChar +0x000 Type : Pos 0, 3 Bits +0x000 Audit : Pos 3, 1 Bit +0x000 Signer : Pos 4, 4 Bits...

Windows-Kernel-Exploitation

1. 利用命名管道进行非分页池溢出利用 基于命名管道的池溢出利用技术，在 CVE-2020-17087 和一次 off-by-one 溢出中进行了演示 2. 段堆 VS 分配器元数据滥用 通过滥用段堆 VS 分配器元数据，将潜在受限的写入原语（例如池溢出）转化为重叠块分配的技术 工具 目前包含一个用于检查段堆内部状态的 windbg 脚本...

CVE-2020-15368-AsrDrv103-research

CVE-2020-15368 — AsrDrv103.sys 本仓库包含与 CVE-2020-15368 相关的 ASRock AsrDrv103.sys Windows 内核驱动程序逆向工程材料。 该项目是作为 Windows 内核驱动程序、驱动通信接口、底层硬件访问以及易受攻击驱动设计的实践研究而创建的。 我不是 CVE-2020-15368 的原始发现者。本仓库的目标是记录我自己对该驱动程序的分析和理解。 分析报告 完整分析报告可在 reports 目录中找到： 俄语版本 英语版本 样本 AsrDrv103 SHA-256...

CVE-2022-37969PoC

Contents General Introduction This was made to clarify general aspects concerning Windows exploitation. It explains basic concepts applied to CVE-2022-37969. The final result is a working PoC. It does not clarify every aspect about the CVE, but provides re-usable pieces of code and explains...